Original URL: http://www.theregister.co.uk/2006/01/26/security_researcher_versus_oracle/

Oracle in war of words with security researcher

'What David Litchfield has done is put our customers at risk'

By Robert Lemos

Posted in Security, 26th January 2006 07:03 GMT

ARLINGTON, Virginia - A security researcher released details of a critical flaw in Oracle's application and Web software on Wednesday, criticising the company for not cooperating with the security community and taking too long to fix software issues that threaten its customers.

The flaw occurs in the way that a module in Oracle's Apache Web server distribution handles input and could give external attackers the ability to take control of a backend Oracle database through the Web server, said David Litchfield, principal researcher of database security firm Next-Generation Security Software, during a presentation at the Black Hat Federal security conference.

The database company should have fixed the issue in the latest critical patch update (CPU), but failed to do so, he said, adding that he believes the flaw is more significant than a privilege escalation issue fixed in less than three months by Oracle in the latest update.

"Oracle missed an opportunity to fix this issue," Litchfield said. "Hopefully, they will do it now."

After hearing about the conference presentation, Oracle slammed the researcher for releasing information about the vulnerability, saying that doing so puts its customers in danger.

"We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available," Duncan Harris, senior director of security assurance for Oracle, said in an interview with SecurityFocus. "What David Litchfield has done is put our customers at risk."

The war of words is the latest battle over the perception that software makers have been slow to respond to vulnerabilities or that researchers irresponsibly release information about a critical flaw.

Last year, NGSSoftware published details of several vulnerabilities in Sybase's database software after the company relented in legal threats against the researcher. At the Black Hat Security Briefings in Las Vegas last summer, networking giant Cisco and network protection firm Internet Security Systems filed suit against a security researcher for disclosing methods to run code on Cisco's networking hardware.

Oracle has taken a significant amount of criticism for its handling of software security issues. Last week, the database giant released a critical patch update (CPU) that fixed at least 82 flaws. Two of the flaws apparently took more than 800 days to fix. That's nothing new - last year, researchers took the company to task for taking more than 650 days to publish a fix for a security issue.

"They are one of the slowest to get things patched," he said. "It is astonishing how backwards they are in terms of fixing security issues.

Litchfield notified the database maker of the issue in October, stating that the fix is fairly straightforward. On Wednesday, he posted a workaround for the vulnerability on SecurityFocus' BugTraq mailing list.

However, Oracle said it studied the workaround proposed by Litchfield and found it inadequate. The configuration changes have at least five technical problems that could cause problems for some applications, Oracle's Harris said. He recommended that any customer that considers deploying the workaround first test it on a non-production server.

The release of details regarding the vulnerability has put more pressure on the company, he said.

"Exploits could be generated using the details provided in a short amount of time," Harris said. "We are still making an analysis. If we feel the risk is significant, we will release a one-off patch much as Microsoft did with the recent WMF patch."

The Apache module, which contains the flaw, allows Web applications to use the Procedural Language/Structured Query Language (PL/SQL) to dynamically create database calls. The code has security weaknesses that have been perennial sources of problems for the database maker. Oracle has patched various issues found by NGSSoftware four times, and each time, the company finds a way around the patch, Litchfield said.

"It has been four years and Oracle has not fixed this simple thing," Litchfield said. "It was trivial to find, and because the functions have had bugs in the past, people are looking at this."

Other security professionals have also taken Oracle to task for its troubles in effectively handling security researcher and vulnerability disclosure.

"I think Oracle does have some work ahead of it in working better with security researchers," Michael Sutton, director of research for iDefense, a subsidiary of VeriSign, said following the Black Hat presentation. "It is embarrassing for the vendor and bad for users that the same problem has been patched (unsuccessfully) four times. If the vendor and researcher collaborated more closely, this problem would be solved."

While other companies, especially Microsoft, have gotten much better at working with security researchers, Oracle continues to have problems, he said.

This article was originally published at SecurityFocus.